"This error occurs when a user-mode subsystem, such as WinLogon or the Client Server Run-Time Subsystem (CSRSS), has been fatally compromised and security can no longer be guaranteed. In response, the operating system switches to kernel mode. Microsoft Windows cannot run without WinLogon or CSRSS. Therefore, this is one of the few cases where the failure of a user-mode service can shut down the system.
Mismatched system files can also cause this error. This can occur if you have restored your hard disk from a backup. Some backup programs might skip restoring system files that they determine are in use."
Restart your computer, and press F8 at the character-based menu that displays the operating system choices.
At the resulting WindowsAdvanced Options menu, choose the Last Known Good Configuration option. This option is most effective when only one driver or service is added at a time.
If the system partition is formatted with NTFS file system, you might be able to use Safe Mode to rename or delete the faulty software.
If the faulty software is used as part of the system startup process in Safe Mode, you need to start the computer using the Recovery Console in order to access the file.
If a newly installed piece if hardware is suspected, remove it to see if this resolves the issue.
Resolving a mismatched system file problem: If you have recently restored your hard disk from a backup, check if there is an updated version of the Backup/Restore program available from the manufacturer. Make sure the latest Windows Service Pack is installed.